repo_add_keydir: put flags last (as with the other repo_add calls)
support signature verification in bindings